rule elf_bpfdoor_w3 {
    meta:
        description = "Detects BPFDoor, new 2023 variant"
        author = "Sorint.lab"
        creation_date = "2023-05-15"
        last_modified = "2023-05-15"
        reference_sample = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
        severity = 100
        scan_context = "file, memory"
        os = "linux"
        notes = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bpfdoor"
        malpedia_version = "20230515"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
        malpedia_rule_date = "20230515"
        malpedia_hash = ""
    strings:
        // BPF Code detected in the executable
        $op1 = { 28 00 00 00 0C 00 00 00 15 00 00 09 DD 86 00 00 }
        $op2 = { 15 00 11 10 BB 01 00 00 15 00 00 11 00 08 00 00 }
        // Magic number 0x4430CD9F
        $op3 = { 9F CD 30 44 }
    condition:
        uint16(0) == 0x457f and all of them
}